Mortezakoohjani 12c8615615 Ship enterprise Accounting FE/API with CRUD parity and production wiring.

Adds accounting-service PATCH/archive, fiscal helpers, COA templates and setup status, plus SuperApp Accounting UI (DS, scoreboard, masters, vouchers, ledger, ops modules) with session refresh and HTTPS public API URLs.

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-24 15:26:43 +03:30

1.5 KiB

Raw Blame History

Identity Architecture

Layers (mandatory separation)

Layer	Who	Central Keycloak SSO
Platform core	Platform admin, tenant owner/staff	Required
Subsystem staff UIs	Cafe panel, CRM, …	Required — same JWT
Tenant end-customer	e.g. digital menu guest	Optional — may be local to module DB

Keycloak realm superapp, theme torbatyar:

Tab: password (username/email/mobile + password)
Tab: mobile OTP (Identity /auth/mobile/* → handoff → /auth/callback)

Frontend /login and /register redirect to Keycloak. Admin login uses the same SSO path.

Core Users

Table users in core_platform_db: mobile (unique, required), mobile_verified, keycloak_sub, current_tenant_id, platform role.

UserService.resolve_current maps:

Local OTP JWT → users.id
Keycloak JWT → users.keycloak_sub (JIT link/create when possible)

Identity Service

Database identity_access_db. Profiles hold Keycloak subject, mobile verification, optional core_user_id. OTP SMS is delegated to Core (CoreOtpClient) — no duplicate SMS logic.

Mobile Mandate

Mobile is mandatory and OTP-verified (ADR-005).

1.5 KiB Raw Blame History